Prisma Cloud Remediation - AWS EC2 Instance Misconfiguration Deprecated Hidden

Deprecated. Use Prisma Cloud Remediation - AWS EC2 Instance Misconfiguration v2 instead. This playbook remediates Prisma Cloud AWS EC2 alerts. It calls the following sub-playbooks to perform the remediation: - AWS Default Security Group Does Not Restrict All Traffic - AWS Security Groups Allow Internet Traffic - AWS Security Groups With Inbound Rule Overly Permissive To All Traffic - AWS Security Groups allow internet traffic from internet to FTP-Data port (20) - AWS Security Groups allow internet traffic from internet to FTP port (21) - AWS Security Groups allow internet traffic to SSH port (22) - AWS Security Group allows all traffic on SSH port (22) - AWS Security Groups allow internet traffic from internet to Telnet port (23) - AWS Security Groups allow internet traffic from internet to SMTP port (25) - AWS Security Groups allow internet traffic from internet to DNS port (53) - AWS Security Groups allow internet traffic from internet to Windows RPC port (135) - AWS Security Groups allow internet traffic from internet to NetBIOS port (137) - AWS Security Groups allow internet traffic from internet to NetBIOS port (138) - AWS Security Groups allow internet traffic from internet to CIFS port (445) - AWS Security Groups allow internet traffic from internet to SQLServer port (1433) - AWS Security Groups allow internet traffic from internet to SQLServer port (1434) - AWS Security Groups allow internet traffic from internet to MYSQL port (3306) - AWS Security Groups allow internet traffic from internet to RDP port (3389) - AWS Security Groups allow internet traffic from internet to MSQL port (4333) - AWS Security Groups allow internet traffic from internet to PostgreSQL port (5432) - AWS Security Groups allow internet traffic from internet to VNC Listener port (5500) - AWS Security Groups allow internet traffic from internet to VNC Server port (5900)

Prisma Cloud by Palo Alto Networks · 13 tasks · 2 inputs · 0 outputs

Details

IDPrisma Cloud Remediation - AWS EC2 Instance Misconfiguration
From Version5.0.0
Tasks13

README

Remediates Prisma Cloud AWS EC2 alerts. It calls the following sub-playbooks to perform the remediation:

  • AWS Default Security Group Does Not Restrict All Traffic
  • AWS Security Groups Allow Internet Traffic
  • AWS Security Groups With Inbound Rule Overly Permissive To All Traffic
  • AWS Security Groups allow internet traffic from internet to FTP-Data port (20)
  • AWS Security Groups allow internet traffic from internet to FTP port (21)
  • AWS Security Groups allow internet traffic to SSH port (22)
  • AWS Security Group allows all traffic on SSH port (22)
  • AWS Security Groups allow internet traffic from internet to Telnet port (23)
  • AWS Security Groups allow internet traffic from internet to SMTP port (25)
  • AWS Security Groups allow internet traffic from internet to DNS port (53)
  • AWS Security Groups allow internet traffic from internet to Windows RPC port (135)
  • AWS Security Groups allow internet traffic from internet to NetBIOS port (137)
  • AWS Security Groups allow internet traffic from internet to NetBIOS port (138)
  • AWS Security Groups allow internet traffic from internet to CIFS port (445)
  • AWS Security Groups allow internet traffic from internet to SQLServer port (1433)
  • AWS Security Groups allow internet traffic from internet to SQLServer port (1434)
  • AWS Security Groups allow internet traffic from internet to MYSQL port (3306)
  • AWS Security Groups allow internet traffic from internet to RDP port (3389)
  • AWS Security Groups allow internet traffic from internet to MSQL port (4333)
  • AWS Security Groups allow internet traffic from internet to PostgreSQL port (5432)
  • AWS Security Groups allow internet traffic from internet to VNC Listener port (5500)
  • AWS Security Groups allow internet traffic from internet to VNC Server port (5900)

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • Prisma Cloud Remediation - AWS EC2 Security Group Misconfiguration
  • Prisma Cloud Remediation - AWS Security Groups Allows Internet Traffic To TCP Port

Integrations

  • Builtin
  • PrismaCloud v2

Scripts

This playbook does not use any scripts.

Commands

  • closeInvestigation
  • redlock-dismiss-alerts

Playbook Inputs

Name Description Default Value Source Required
AutoUpdateEC2 Whether to update the AWS EC2 instance automatically. no - Optional
policyId Returns the Prisma Cloud policy ID. labels.policy incident Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

PCR_AWS_EC2_Instance_Misconfig

Inputs

  • AutoUpdateEC2 — Update AWS EC2 instance automatically?
  • policyId — Get the Prisma Cloud policy ID.

Commands used

redlock-dismiss-alerts

Flowchart

yes yes Yes yes internetPorts securityGroups yes Start Start Is AWS - EC2 integration available? - IsIntegrationAvailable Is AWS - EC2 integration ... IsIntegrationAvailable Update EC2 automatically? Update EC2 automatically? Auto remediate? Auto remediate? Manually remediate EC2 Manually remediate EC2 Close investigation Close investigation Done Done Is Prisma Cloud v2 integration enabled? Is Prisma Cloud v2 integr... Execute playbook Execute playbook Is there a policy to remediate? Is there a policy to reme... Prisma Cloud Remediation - AWS EC2 Security Group Misconfiguration - Prisma Cloud Remediation - AWS EC2 Security Group Misconfiguration Prisma Cloud Remediation ... Prisma Cloud Remediation - AW... Prisma Cloud Remediation - AWS Security Groups Allows Internet Traffic To TCP Port - Prisma Cloud Remediation - AWS Security Groups Allows Internet Traffic To TCP Port Prisma Cloud Remediation ... Prisma Cloud Remediation - AW... Dismiss Prisma Cloud alert - redlock-dismiss-alerts Dismiss Prisma Cloud alert redlock-dismiss-alerts

Source

playbook-PCR_-_AWS_EC2_Instance_Misconfig.yml playbook-PCR_-_AWS_EC2_Instance_Misconfig_v2.yml playbook-PCR_-_AWS_EC2_Instance_Misconfig_v2_README.md
Download History Raw 
This playbook remediates Prisma Cloud AWS EC2 alerts.  It calls the following sub-playbooks to perform the remediation:
- AWS Default Security Group Does Not Restrict All Traffic (policy id: 2378dbf4-b104-4bda-9b05-7417affbba3f)
- AWS Security Group allows all traffic on SSH port (22) (policy id: 617b9138-584b-4e8e-ad15-7fbabafbed1a)
- AWS Security Groups allow internet traffic from internet to RDP port (3389) (policy id: b82f90ce-ed8b-4b49-970c-2268b0a6c2e5).

## Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

### Sub-playbooks

* Prisma Cloud Remediation - AWS Security Groups Allows Internet Traffic To TCP Port
* Prisma Cloud Remediation - AWS EC2 Security Group Misconfiguration

### Integrations

* PrismaCloud v2

### Scripts

* IsIntegrationAvailable

### Commands

* closeInvestigation
* prisma-cloud-alert-dismiss

## Playbook Inputs

---

| **Name** | **Description** | **Default Value** | **Required** |
| --- | --- | --- | --- |
| AutoUpdateEC2 | Update AWS EC2 instance automatically? | no | Optional |
| policyId | Get the Prisma Cloud policy ID. | incident.labels.policy | Optional |

## Playbook Outputs

---
There are no outputs for this playbook.

## Playbook Image

---

![Prisma Cloud Remediation - AWS EC2 Instance Misconfiguration v2](../doc_files/Prisma_Cloud_Remediation_-_AWS_EC2_Instance_Misconfiguration_v2.png)